Prevent development-version builds from being published to PyPI stable

[tbitcs]

Problem

PyPI's latest public release is 0.20.1, but a project can be migrated to a development build such as 0.21.0.dev787. On Windows, pipx upgrade specsmith then correctly stays at the stable PyPI release, while the project rejects it as a downgrade. Installing the development build manually can also leave multiple specsmith.exe launchers on PATH.

Development versions must never be accepted into the PyPI stable distribution channel.

Requested behavior

• Add a release-pipeline guard that fails before upload when the version is any PEP 440 pre-release or development release (.devN, aN, bN, rcN, or local-version suffix).
• Publish development artifacts only to an explicitly opt-in dev channel or TestPyPI, never to the default PyPI project.
• Make specsmith channel set stable reject a locally installed pre-release and offer the latest stable version.
• Add CI coverage for accepted stable versions and rejected development/pre-release versions.
• Document the supported upgrade path so pipx install specsmith and pipx upgrade specsmith always resolve a stable version.

Observed environment

• Windows 11 / Python 3.12
• PyPI latest: specsmith 0.20.1 (released 2026-06-29)
• pipx list had specsmith 0.21.0.dev787
• Get-Command specsmith -All found both the pipx launcher and a Python Scripts launcher

Related Windows install/path and downgrade-recovery reports: #286 and #287.